Deploy anatomy: mobile + de-CDN + verify-widget (from platform main)

Forge push from replit-sync source. Content files only; README/space-config preserved.

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @szl-holdings/core-engine

.github/workflows/overclaim-guard.yml

@@ -0,0 +1,20 @@
+name: Doctrine Overclaim Guard
+
+# Grep-based honesty gate. The rule lives in ONE place — the org-shared
+# reusable workflow in szl-holdings/.github — so every repo that publishes
+# Λ-uniqueness / Conjecture-1 claims inherits the same check automatically.
+# Fails CI if a governed surface claims Λ uniqueness without the Theorem U /
+# U₁ / U₂ qualifier, or describes Conjecture 1 as proven/closed (it stays OPEN).
+on:
+  workflow_dispatch: {}
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  overclaim:
+    uses: szl-holdings/.github/.github/workflows/reusable-overclaim-guard.yml@main

.github/workflows/pin-check.yml

@@ -0,0 +1,20 @@
+name: Pin Check
+
+# Thin caller — delegates to the org-wide reusable SHA-pin check so this repo's
+# workflow files are validated identically to every other repo. The reusable is
+# pinned by commit SHA (the rule it enforces). See szl-holdings/.github
+# replit-sync/FORGE_UPGRADE_pincheck-orgwide.md.
+
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    paths: ['.github/workflows/**']
+
+permissions:
+  contents: read
+
+jobs:
+  pin-check:
+    uses: szl-holdings/.github/.github/workflows/pin-check-reusable.yml@1bbd857634a87d3a824be86ec7a79aaa8e4937e8

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

index.html

@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
 <meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2" />
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2, viewport-fit=cover" />
 <title>SZL Agent Body v4 (deepen) — Living Anatomy · Formula Atlas + honest forecast</title>
 <meta name="description" content="The SZL Agent Body v4 — a genuine anatomical organism. Two bodies (a11oy + killinchu) sharing one circulatory (YAWAR receipt bus) + nervous (span lineage) mesh, with proven formulas flowing through the organs and the Λ heart beating at the center." />
 <style>
@@ -853,6 +853,190 @@
     body.ux2 #honesty{max-width:min(300px,42vw)}
   }
 
+  /* ===== ADDITIVE (Dev C): “ask the fabric” verify launcher + modal — no V8/V9/scene logic touched ===== */
+  #verify-fab{position:fixed;z-index:60;left:16px;bottom:18px;display:inline-flex;align-items:center;gap:7px;
+    font-family:var(--font-m);font-size:11px;letter-spacing:.04em;color:var(--a11oy);
+    background:var(--surface);backdrop-filter:blur(var(--blur));border:1px solid var(--border);
+    border-radius:99px;padding:9px 15px;cursor:pointer;transition:all .18s;box-shadow:var(--shadow)}
+  #verify-fab:hover{border-color:var(--a11oy);color:#bff7ec}
+  #verify-modal{position:fixed;z-index:70;inset:0;display:none;align-items:flex-start;justify-content:center;
+    background:rgba(2,4,10,0.74);backdrop-filter:blur(5px);padding:6vh 14px;overflow:auto;transition:opacity .2s ease}
+  #verify-modal.show{display:flex}
+  #verify-modal .vm-inner{position:relative;width:100%;max-width:660px}
+  #verify-modal .vm-close{position:absolute;top:-34px;right:0;cursor:pointer;color:var(--text-dim);
+    font-size:24px;background:none;border:0;line-height:1}
+  #verify-modal .vm-close:hover{color:var(--a11oy)}
+  #verify-modal .vm-lede{color:var(--text-muted);font:12px/1.5 var(--font-m);margin:0 0 12px;max-width:660px}
+  @media (prefers-reduced-motion:reduce){#verify-modal{transition:none}}
+  @media (max-width:680px){#verify-fab{left:50%;transform:translateX(-50%);bottom:max(14px, env(safe-area-inset-bottom))}}
+
+
+/* ===========================================================
+   DEV B · MOBILE TYPE FLOOR (anatomy · ADDITIVE / CSS-ONLY)
+   Raises every sub-12px label to ≥12px on phones/tablets.
+   Does NOT touch the V8/V9 dual-body scene, app.js, or data.js.
+   Honesty preserved: organs EXPERIMENTAL, Λ=Conjecture 1 (advisory),
+   Khipu BFT=Conjecture 2, effectors SIMULATED, SLSA L1 honest.
+   =========================================================== */
+@media (max-width: 768px){
+#verify-fab,
+#title .eyebrow,
+.body-tag,
+#honesty .hdr,
+#honesty .row,
+.chip,
+#legend h3,
+.sys-row .qn,
+.sys-row .fnx,
+.btn,
+#panel .ph .sys-pill,
+#panel .axes,
+.sec-h,
+.formula .fid,
+.formula .fplain,
+.formula .fax,
+.formula .fref,
+.gpd-cell .gpd-k,
+.gpd-dois .doi span,
+.lambda-honesty .lh-h,
+#tip .tt,
+#tip .tm,
+#vf-static .vf-sys,
+#vf-static .vf-chip,
+#vf-static .vf-plain,
+#vf-static .vf-ax,
+#vf-static .vf-ref,
+#dissect .dz-head,
+.dz-sec > .dz-label,
+.dz-layer .lname,
+.dz-row,
+.dz-row .val,
+.dz-axis button,
+.dz-mini,
+.dz-results li,
+.dz-results li .rk,
+.dz-results li .rt,
+#vis-hud .vh-head,
+#vis-hud .vh-stat .k,
+#vis-hud .vh-stat .v.conj,
+#vis-hud .vh-foot,
+#atlas .at-eyebrow,
+#atlas .at-note,
+.at-pill,
+.at-pill .ct,
+.at-tier-h,
+.at-tier-h .tc,
+.at-tier-h .td,
+.at-empty,
+.fdrill summary,
+.fdrill .fax2,
+.lean-link,
+#forecast .fc-eyebrow,
+#forecast .fc-note,
+.fc-spark .sp-h,
+.fc-legend,
+.fc-sec-h,
+.fc-event .ev-when,
+.fc-event .ev-what,
+.fc-tag,
+.fc-disc,
+#qbio .qb-eyebrow,
+#qbio .qb-note,
+.qb-card .qc-h,
+.qb-card .qc-row,
+.qb-card .qc-row b,
+.qb-card .qc-math,
+.qb-card .qc-plain,
+.qb-stat,
+.qb-sec-h,
+.qb-leader,
+.qb-src,
+.qb-src .qs-tag,
+.qb-thm .qt-id,
+.qb-thm .qt-lean,
+.qb-thm .qt-plain,
+.qb-disc,
+.qb-organ .qo-h,
+.qb-organ .qo-grid,
+.qb-organ .qo-verdict,
+.olabel,
+.olabel .od,
+#tour .tr-step,
+#tour .tr-prog,
+#tour .tr-body,
+#tour .tr-ctrl button,
+.v8-title,
+.v8-head,
+.v8-state,
+.v8-k,
+.v8-v code,.v8-vitals code,
+.v8-note,
+.v8-load,
+.v8-tag,
+#v8-vitals .v8-vrow,
+#v8-vitals .v8-vk,
+#v8-vitals #v8-vitals-locked,
+#v8-flow .v8-flow-eyebrow,
+#v8-flow .v8-flow-sub,
+#v8-flow-run,
+.v8-flow-head,
+.v8-step-l,
+.v8-step-d,
+#v9-master #v9-master-state,
+#v9-master-ago,
+#v9-master-rate,#v9-master-lambda,
+#v9-master-proxy,
+#v9-beat-pause,
+#v9-tour .v9-tour-eyebrow,
+#v9-tour-prog,
+#v9-tour-body,
+#v9-tour .v9-tour-ctrl button,
+.v9-trace-head,.v9-k-head,
+.v9-trace-k,
+.v9-trace-v,
+.v9-trace-v code,
+.v9-dim,
+.v9-trace-note,
+body.ux2 #title .sub,
+.ux-trust-head .tlabel,
+.ux-tchip,
+.ux-details > summary,
+body.ux2 #ux-tabbar .uxt{
+    font-size:12px !important; line-height:1.5 !important;
+  }
+}
+
+/* ---- Touch targets >= 44px (additive; dense scientific UI -> 44px primary) ---- */
+@media (pointer:coarse),(max-width: 768px){
+  #tour .tr-ctrl button, #v9-tour .v9-tour-ctrl button,
+  .dz-axis button, .dz-mini, .btn, .lean-link,
+  #v8-flow-run, #v8-flow-fab, .at-pill, .ux-tchip,
+  .fdrill summary, .ux-details > summary{
+    min-height:44px !important; display:inline-flex !important;
+    align-items:center !important; justify-content:center !important;
+  }
+  .dz-toggle{ min-height:44px !important; min-width:44px !important; }
+  #verify-fab{ min-height:44px !important; }
+  #panel .close, #dissect .at-close, .at-close, #tip .close,
+  #legend .close, #honesty .close, #atlas .at-close, #vf-close,
+  button[aria-label="close"], button[aria-label^="close"], .close{
+    min-width:44px !important; min-height:44px !important;
+    display:inline-flex !important; align-items:center !important; justify-content:center !important;
+  }
+  input, select, textarea{ min-height:44px !important; }
+}
+
+/* ---- safe-area insets (notch / home-bar) ; viewport-fit=cover added to meta ---- */
+@media (max-width: 768px){
+  #vis-hud{ padding-bottom:max(8px, env(safe-area-inset-bottom)) !important; }
+  #dissect{ padding-bottom:max(12px, calc(12px + env(safe-area-inset-bottom))) !important; }
+  #ux-tabbar{ padding-bottom:max(0px, env(safe-area-inset-bottom)) !important; }
+  #honesty, #title{ padding-left:max(0px, env(safe-area-inset-left)); padding-right:max(0px, env(safe-area-inset-right)); }
+  /* long Lean axiom lines / DOIs must wrap, never cause horizontal overflow */
+  code, .vf-ax, .v9-trace-v code, .v8-v code, .gpd-dois .doi span,
+  .formula .fax, .fdrill .fax2{ overflow-wrap:anywhere !important; word-break:break-word !important; }
+}
+
 </style>
 </head>
 <body>
@@ -1270,7 +1454,7 @@
   <div class="hud" id="title">
     <div class="eyebrow">SZL Holdings · Living Anatomy</div>
     <h1>SZL Agent Body <span class="v3">v4</span> — the governed-AI organ substrate</h1>
-    <div class="sub">An interactive 3D body for governed AI. Click an organ, or take the guided tour. &nbsp;<a href="./live-body.html" style="color:var(--nerve);text-decoration:underline">▶ live body view →</a></div>
+    <div class="sub">An interactive 3D body for governed AI. Click an organ, or take the guided tour.</div>
     <div class="bodies">
       <span class="body-tag a">a11oy · governed-AI decision body</span>
       <span class="body-tag k">killinchu · maritime / drone C2 body</span>
@@ -1735,10 +1919,41 @@
   })();
   </script>
 
+  <!-- ===== ADDITIVE (Dev C): “ask the fabric” verify launcher + modal ===== -->
+  <button id="verify-fab" type="button" aria-haspopup="dialog" aria-controls="verify-modal">◈ ask the fabric · verify a receipt</button>
+  <div id="verify-modal" role="dialog" aria-modal="true" aria-label="Ask the fabric — verify a receipt">
+    <div class="vm-inner">
+      <button class="vm-close" id="verify-close" aria-label="Close">×</button>
+      <p class="vm-lede">Paste a Khipu receipt / DSSE envelope / in-toto statement (or load the sample) and
+        submit it to the <b>live</b> a11oy verify endpoint. Unsigned → <b>STRUCTURAL-ONLY</b> (advisory,
+        never a false green). Verifies receipts / DSSE / in-toto — not arbitrary text. Λ = Conjecture 1.</p>
+      <div id="szl-verify"></div>
+    </div>
+  </div>
+
   <!-- ZERO CDN: vendored Three.js r160 + local data + local app -->
   <script src="./lib/three.min.js"></script>
   <script src="./data.js"></script>
   <script src="./app.js"></script>
+  <!-- ADDITIVE: vendored, self-contained verify widget (0 CDN, system fonts, honest fallback) -->
+  <script src="./lib/szl_verify_widget.js"></script>
+  <script>
+    (function(){
+      var fab=document.getElementById('verify-fab');
+      var modal=document.getElementById('verify-modal');
+      var close=document.getElementById('verify-close');
+      var mounted=false;
+      function open(){
+        if(!mounted && window.SZLVerify){ SZLVerify.mount('#szl-verify',{base:'https://a11oy.net'}); mounted=true; }
+        modal.classList.add('show');
+      }
+      function hide(){ modal.classList.remove('show'); }
+      if(fab) fab.addEventListener('click', open);
+      if(close) close.addEventListener('click', hide);
+      if(modal) modal.addEventListener('click', function(e){ if(e.target===modal) hide(); });
+      document.addEventListener('keydown', function(e){ if(e.key==='Escape') hide(); });
+    })();
+  </script>
 </body>
 </html>
 

lib/szl_verify_widget.js

@@ -0,0 +1,207 @@
+/* ============================================================================
+ * SZL "ask the fabric" — verify-a-claim widget  (vendored, self-contained)
+ * ----------------------------------------------------------------------------
+ * 0 runtime CDN · system fonts only · AbortController · honest fallback.
+ * Calls the REAL a11oy verify endpoint and renders its REAL honest verdict.
+ *   POST {base}/api/a11oy/v1/verify   body = a receipt / DSSE envelope / in-toto stmt
+ *   GET  {base}/api/a11oy/v1/verify?url=<public receipt url>
+ *
+ * Doctrine v11: this widget NEVER fabricates a verdict. It shows exactly what
+ * the server returns (verdict: VERIFIED | STRUCTURAL-ONLY | FAILED | UNRECOGNISED).
+ * "STRUCTURAL-ONLY" is shown as advisory, NOT green. Network/timeout/429 degrade
+ * to an honest "unreachable / rate-limited" state — never to a false green.
+ *
+ * Attribution (clean-room rebuild of permissive ideas — see dev7 report):
+ *   - Tool-call / receipt trace UI pattern inspired by smolagents (Apache-2.0,
+ *     huggingface/smolagents) and assistant-ui (MIT). Rebuilt SZL-native; no code copied.
+ *   - AbortController fetch contract reuses anatomy V8 (SZL own prior art).
+ * ==========================================================================*/
+(function (global) {
+  'use strict';
+
+  var DEFAULT_BASE = 'https://a11oy.net'; // same fabric the estate already talks to
+  var TIMEOUT_MS   = 12000;
+  var SAMPLE = {
+    _type: 'https://in-toto.io/Statement/v1',
+    subject: [{ name: 'szl-lake/homflyreceipt_gate',
+      digest: { sha256: '0a2d153d81c00688b576e5a012ae6117465639807456d1bb72eb590cac3b1e9d' } }],
+    predicateType: 'https://szlholdings.com/attestations/innovation/v1',
+    predicate: { note: 'paste your own receipt JSON here, or a public receipt URL' }
+  };
+
+  function esc(s){ return String(s==null?'':s).replace(/[&<>"]/g,function(c){
+    return {'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]; }); }
+
+  /* honest fetch contract: AbortController + try/catch. NEVER throws. ----- */
+  function pull(url, opts, timeoutMs){
+    var ctl = (typeof AbortController!=='undefined') ? new AbortController() : null;
+    var to  = ctl ? setTimeout(function(){ try{ctl.abort();}catch(e){} }, timeoutMs||TIMEOUT_MS) : null;
+    opts = opts || {};
+    opts.signal = ctl ? ctl.signal : undefined;
+    opts.cache  = 'no-store';
+    opts.mode   = 'cors';
+    return fetch(url, opts).then(function(r){
+      if(to) clearTimeout(to);
+      var status = r.status;
+      return r.json().then(function(data){ return {ok:r.ok, status:status, data:data}; },
+                          function(){ return {ok:false, status:status, data:null}; });
+    }).catch(function(e){
+      if(to) clearTimeout(to);
+      var aborted = e && (e.name==='AbortError');
+      return {ok:false, status:0, data:null, err:String(e&&e.message||e), aborted:aborted};
+    });
+  }
+
+  /* map an HONEST verdict string -> {label, cls, advisory} ---------------- */
+  function verdictView(v){
+    var s = String(v||'').toUpperCase();
+    if(s==='VERIFIED')        return {label:'VERIFIED',        cls:'ok',   advisory:false};
+    if(s==='STRUCTURAL-ONLY') return {label:'STRUCTURAL-ONLY', cls:'warn', advisory:true};
+    if(s==='FAILED')          return {label:'FAILED',          cls:'fail', advisory:false};
+    if(s==='UNRECOGNISED')    return {label:'UNRECOGNISED',    cls:'muted',advisory:false};
+    return {label: s||'—', cls:'muted', advisory:false};
+  }
+
+  function renderChecks(checks){
+    if(!Array.isArray(checks) || !checks.length) return '';
+    var rows = checks.map(function(c){
+      var st = String(c.status||'').toLowerCase();
+      var cls = st==='pass' ? 'ok' : (st==='fail' ? 'fail' : 'muted');
+      return '<li class="szlv-chk"><span class="szlv-pill '+cls+'">'+esc(c.status||'?')+'</span>'+
+             '<code>'+esc(c.name||'check')+'</code>'+
+             (c.detail ? '<span class="szlv-det">'+esc(c.detail)+'</span>' : '')+'</li>';
+    }).join('');
+    return '<ul class="szlv-checks">'+rows+'</ul>';
+  }
+
+  function renderResult(res){
+    // res is the {ok,status,data,err,aborted} envelope from pull()
+    if(res.status===429){
+      return '<div class="szlv-state fail">rate-limited · the fabric caps at 60/min per IP. '+
+             'This is honest backpressure, not a failure of your receipt. Try again shortly.</div>';
+    }
+    if(!res.ok || !res.data){
+      var why = res.aborted ? 'timed out' : (res.status ? ('HTTP '+res.status) : 'unreachable');
+      return '<div class="szlv-state muted">offline · fabric '+esc(why)+
+             '. No verdict shown — the widget never invents a green. '+
+             'Re-run the checks yourself per docs/developers/VERIFY.md.</div>';
+    }
+    var d = res.data;
+    var vv = verdictView(d.verdict);
+    var head = '<div class="szlv-verdict '+vv.cls+'">'+
+      '<span class="szlv-dot"></span><b>'+esc(vv.label)+'</b>'+
+      (vv.advisory ? '<span class="szlv-adv">advisory · not a cryptographic green</span>' : '')+
+      '</div>';
+    var detail = d.detail ? '<p class="szlv-detail">'+esc(d.detail)+'</p>' : '';
+    var kinds  = (Array.isArray(d.kinds)&&d.kinds.length)
+      ? '<p class="szlv-kinds">recognised as: '+d.kinds.map(esc).join(', ')+'</p>' : '';
+    var checks = renderChecks(d.checks);
+    var foot = '<p class="szlv-foot">engine '+esc(d.engine_version||'?')+
+      ' · doctrine '+esc((d.doctrine&&d.doctrine.version)||'v11')+
+      ' · Λ='+esc((d.doctrine&&d.doctrine.lambda)||'Conjecture 1')+
+      (d.verified_at ? ' · '+esc(d.verified_at) : '')+
+      '<br><span class="szlv-trust">No trust in the server is required — re-verify with cosign / rekor-cli / lake build.</span></p>';
+    return head+detail+kinds+checks+foot;
+  }
+
+  var CSS = [
+    '.szlv{font-family:system-ui,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;',
+    'color:#cdccca;background:#1c1b19;border:1px solid #393836;border-radius:10px;padding:16px;max-width:640px}',
+    '.szlv h3{font-size:15px;margin:0 0 4px;font-weight:600;letter-spacing:.2px}',
+    '.szlv .szlv-sub{font-size:12px;color:#797876;margin:0 0 12px}',
+    '.szlv textarea{width:100%;min-height:120px;box-sizing:border-box;background:#171614;color:#cdccca;',
+    'border:1px solid #393836;border-radius:8px;padding:10px;font:12px/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;resize:vertical}',
+    '.szlv-row{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}',
+    '.szlv input[type=text]{flex:1;min-width:200px;background:#171614;color:#cdccca;border:1px solid #393836;border-radius:8px;padding:8px 10px;font-size:12px}',
+    '.szlv button{background:#01696f;color:#fff;border:0;border-radius:8px;padding:9px 16px;font-size:13px;font-weight:600;cursor:pointer}',
+    '.szlv button:hover{background:#0c4e54}.szlv button:disabled{opacity:.5;cursor:wait}',
+    '.szlv button.ghost{background:transparent;color:#4f98a3;border:1px solid #393836}',
+    '.szlv-out{margin-top:12px;font-size:13px;min-height:24px}',
+    '.szlv-load{color:#797876;font-size:12px}',
+    '.szlv-verdict{display:flex;align-items:center;gap:8px;font-size:15px;padding:8px 10px;border-radius:8px;border:1px solid #393836}',
+    '.szlv-verdict .szlv-dot{width:9px;height:9px;border-radius:50%}',
+    '.szlv-verdict.ok .szlv-dot{background:#6daa45}.szlv-verdict.ok{border-color:#3a5a26}',
+    '.szlv-verdict.warn .szlv-dot{background:#e8af34}.szlv-verdict.warn{border-color:#6b5418}',
+    '.szlv-verdict.fail .szlv-dot{background:#d163a7}.szlv-verdict.fail{border-color:#7a2c5a}',
+    '.szlv-verdict.muted .szlv-dot{background:#797876}',
+    '.szlv-adv{font-size:11px;color:#e8af34;font-weight:400;margin-left:auto}',
+    '.szlv-detail{font-size:12px;color:#a9a8a5;margin:8px 0}',
+    '.szlv-kinds{font-size:11px;color:#797876;margin:4px 0}',
+    '.szlv-checks{list-style:none;margin:8px 0 0;padding:0;display:flex;flex-direction:column;gap:4px}',
+    '.szlv-chk{display:flex;align-items:center;gap:8px;font-size:12px;flex-wrap:wrap}',
+    '.szlv-pill{font-size:10px;text-transform:uppercase;letter-spacing:.4px;padding:2px 6px;border-radius:4px;font-weight:700}',
+    '.szlv-pill.ok{background:rgba(109,170,69,.18);color:#6daa45}',
+    '.szlv-pill.fail{background:rgba(209,99,167,.18);color:#d163a7}',
+    '.szlv-pill.muted{background:#2a2927;color:#797876}',
+    '.szlv-chk code{color:#cdccca}.szlv-det{color:#797876;font-size:11px}',
+    '.szlv-foot{font-size:10px;color:#5a5957;margin:10px 0 0;line-height:1.5}',
+    '.szlv-trust{color:#797876}',
+    '.szlv-state{font-size:12px;padding:8px 10px;border-radius:8px}',
+    '.szlv-state.fail{background:rgba(209,99,167,.10);color:#d163a7}',
+    '.szlv-state.muted{background:#211f1d;color:#a9a8a5}'
+  ].join('');
+
+  function injectCSS(){
+    if(document.getElementById('szlv-css')) return;
+    var st = document.createElement('style'); st.id='szlv-css'; st.textContent = CSS;
+    document.head.appendChild(st);
+  }
+
+  /* Public mount: SZLVerify.mount('#id', {base})  ------------------------- */
+  function mount(target, opts){
+    opts = opts || {};
+    var base = (opts.base || DEFAULT_BASE).replace(/\/+$/,'');
+    var host = (typeof target==='string') ? document.querySelector(target) : target;
+    if(!host) return null;
+    injectCSS();
+    host.classList.add('szlv');
+    host.innerHTML =
+      '<h3>ask the fabric — verify a receipt</h3>'+
+      '<p class="szlv-sub">Paste a Khipu receipt / DSSE envelope / in-toto statement, '+
+      'or fetch a public receipt by URL. Verdicts are the fabric\u2019s real, honest output '+
+      '(unsigned \u2192 STRUCTURAL-ONLY, never a false green).</p>'+
+      '<textarea class="szlv-ta" spellcheck="false"></textarea>'+
+      '<div class="szlv-row">'+
+        '<input type="text" class="szlv-url" placeholder="\u2026or a public receipt URL (https://\u2026/receipt.json)">'+
+      '</div>'+
+      '<div class="szlv-row">'+
+        '<button class="szlv-go" type="button">Verify</button>'+
+        '<button class="szlv-sample ghost" type="button">Load sample receipt</button>'+
+      '</div>'+
+      '<div class="szlv-out" aria-live="polite"></div>';
+
+    var ta  = host.querySelector('.szlv-ta');
+    var url = host.querySelector('.szlv-url');
+    var out = host.querySelector('.szlv-out');
+    var go  = host.querySelector('.szlv-go');
+    var smp = host.querySelector('.szlv-sample');
+
+    smp.addEventListener('click', function(){ ta.value = JSON.stringify(SAMPLE, null, 2); url.value=''; });
+
+    go.addEventListener('click', function(){
+      go.disabled = true;
+      out.innerHTML = '<span class="szlv-load">calling <code>'+esc(base)+'/api/a11oy/v1/verify</code>\u2026</span>';
+      var p, u = url.value.trim(), body = ta.value.trim();
+      if(u){
+        p = pull(base+'/api/a11oy/v1/verify?url='+encodeURIComponent(u), {method:'GET'});
+      } else if(body){
+        var parsed = null;
+        try{ parsed = JSON.parse(body); }catch(e){
+          out.innerHTML = '<div class="szlv-state muted">input is not valid JSON — paste a receipt object or use a URL.</div>';
+          go.disabled = false; return;
+        }
+        p = pull(base+'/api/a11oy/v1/verify', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(parsed)});
+      } else {
+        out.innerHTML = '<div class="szlv-state muted">paste a receipt JSON, or enter a public receipt URL.</div>';
+        go.disabled = false; return;
+      }
+      p.then(function(res){ out.innerHTML = renderResult(res); go.disabled = false; });
+    });
+
+    return { reload:function(){}, base:base };
+  }
+
+  var api = { mount: mount, pull: pull, _sample: SAMPLE, version: '1.0.0' };
+  if (typeof module!=='undefined' && module.exports) module.exports = api;
+  global.SZLVerify = api;
+})(typeof window!=='undefined' ? window : this);